Android Hook - Xposed Framework

[Android Penetration Testing] Elven

2016/06

Who am I?• Elven Liu

•

•

•

•

• HITCON GIRLS [Android Penetration Testing]

• liuelven@gmail.com

• www.linkedin.com/in/liu-elven

Outline

• Zygote

• Xposed Framework

•

• Hook System Clock

Zygote

Zygote

•

• =

• zygote system/bin/app_process

• Android Zygote

Activity Service

New Activity Process

Accept Socket Connection

Select fd

Read Argument

Parse Argument

Fork() a app_process

Zygote

Socket

fork() Android

Activity Service

New Activity Process

Accept Socket Connection

Select fd

Read Argument

Parse Argument

Fork() a app_process

Zygote

Fork()

Xposed Framework

• rovo89, Tungstwenty

• Source: https://github.com/rovo89

• Module Repository: http://repo.xposed.info/

• systemui, systemserver…….

• XposedBridge API xposed framework JavaJar Package

• XposeInstall Xposed APP

• Xposed: xposed app_process /system/bin/ app_process .orig

WARNING ROM Xposed Xposed Recovery

Activity Service

New Activity Process

Accept Socket Connection

Select fd

Read Argument

Parse Argument

Fork() a app_process

Zygotecom.android.internal.os.ZygoteInit

Activity Service

New Activity Process

Accept Socket Connection

Select fd

Read Argument

Parse Argument

Fork() a app_process

Zygotede.robv.android.xposed.XposedBridge

Activity Service

New Activity Process

Accept Socket Connection

Select fd

Read Argument

Parse Argument

Fork() a app_process

Zygotede.robv.android.xposed.XposedBridge

Input

Android

XposedInstaller APK (4.0)

URL: http://repo.xposed.info/module/

Xposed Bridge API (54)

URL: http://forum.xda-developers.com/xposed/xposed-api-changelog-developer-news-t2714067

Hook

Static Analysis

Hook

Find Target APK

Find Target APK

Static Analysis

reset

Decompiler apk

Find Target*package Name *class*function

Create a Project

Import xposed api

write java code

Root

Hook Success

exposed install

Hook System Clock

https://github.com/rovo89/XposedBridge/wiki/Development-tutorial

Create a Project

build.gradle

1

2

3

AndroidManifest.xml <meta-data

android:name="xposedmodule"

android:value="true"/>

<meta-data

android:name="xposeddescription"

android:value="Hooking Module for Clock" />

<meta-data

android:name="xposedminversion"

android:value="54" />

assets

create java class

• Xposed API

• http://api.xposed.info/reference/de/robv/android/xposed/XC_MethodHook.MethodHookParam.html

Demo